Copilot Autofix

AI about 2 months ago

To fix the problem, we need to ensure that any text assigned to submitButton.innerHTML is properly escaped so that it cannot be interpreted as HTML. The best way to do this is to use textContent instead of innerHTML when restoring the button's original content, as textContent will treat the value as plain text and not parse it as HTML. However, since the loading state uses HTML (a spinner SVG and markup), we need to use innerHTML only for the loading state, and use textContent for restoring the original button label.

Specifically, in the setAIButtonLoadingState function:

• When restoring the button to its original state (isLoading === false), set submitButton.textContent to the value of data-original-content (or 'Ingest').
• When entering the loading state, continue to use innerHTML for the spinner markup.

This change should be made in the region around line 102 in src/static/js/utils_ai.js.